Privacy Policy

Last updated: October 27, 2026

This Privacy Policy explains how PAIR APP LLC (“PAIR,” “we,” “us”) collects, uses, and shares information when you use the PAIR website and mobile app (the “Service”). By using the Service you agree to this Policy. If you do not agree, please do not use the Service.

1. Information we collect

Information you give us

• Account details — your name and email address, and, if you sign in with Google or Apple, the basic profile information those providers share. Passwords are handled by our authentication provider and stored only in hashed form.
• Dietary preferences — diet choices and any allergies or dislikes you enter, which we use to filter what you browse and to flag matching ingredients elsewhere in the app. These automatic checks are best-effort and not a substitute for verifying ingredients yourself. Allergy and health-related information may be treated as sensitive data; we process it only to provide the features you ask for, on the basis of your explicit consent where required.
• Saved content — the ingredients, pairings, recipes (including any photo you add to a recipe), and collections you star or create.
• Share links — when you share a recipe, a plate or a drink pairing as a link, we store a copy of what that link shows: the name and description you gave it, its ingredients and amounts, its method, the harmony score and the drinks we suggest, and which account made it. A link never includes a photo you added, your name or your email address, and a menu link never includes the restaurant’s name.
• Communications — messages you send us (support, feedback).
• Android waitlist — if you gave us your email address through “Notify me” on pair.support while that sign-up was open, we use it once, to tell you the Android app is out, and then delete it. It is not added to any other list. pair.support no longer takes new sign-ups.
• Menu and recipe photos — when you use the PAIR+ menu scanner or recipe scanner, the photo you capture is sent to our AI provider (Anthropic) to read the dishes or ingredients, and used only to return your results. We do not store the image, and it is not used to train AI models. We keep limited metadata about each scan, but never the photo itself (see “Scan safeguards” below).

Payment information

Subscriptions are processed by our payment providers — Stripe for web and the Apple App Store and RevenueCat for in-app purchases. We do not receive or store your full card number. We receive limited billing details such as your subscription status, plan, renewal date, the last four digits and card brand, and (for web) billing country, to operate and support your subscription.

Information collected automatically

• Usage statistics — a short, fixed list of moments in the app: for example that a plan screen was opened, a walkthrough step was reached, a reminder was turned on, or a search found nothing (including the words of that search, up to 40 characters). When you rate how a saved dish tasted, the rating is recorded the same way, together with the dish’s ingredients, amounts and preparations and the score the app showed, but never its name, description, method or photo. Each is tagged with a random ID created for this install of the app. We record these ourselves, with no third-party analytics service. They are not linked to your account, name or email, carry no IP address, are never shared with advertisers or data brokers, and are deleted after 13 months. When you subscribe, our payment systems add one record of the plan and the in-app screen that led to the purchase, also without your account ID. You can turn usage statistics off under Account → Share usage stats, and they are off automatically if your browser sends a Global Privacy Control signal.
• Scan safeguards — to prevent abuse of menu and recipe scanning, we keep limited metadata about each scan for about 30 days: when it happened, whether it could be read, how many photos it had and their size, a one-way fingerprint of the photo used only to spot repeats, the number of dishes read, a one-way fingerprint of the restaurant’s name used only to count different restaurants, the kind of device (our app, a phone browser, a computer browser or other software), and the country your connection came from. This metadata is linked to your account. We do not keep your photos, the names of dishes or restaurants, or your IP address with it. If an account makes an unusually large number of menu scans in a day, menu scanning pauses automatically while a person reviews this metadata. A person reviews every paused account, and we never suspend an account automatically. Once the review is decided we delete the per-scan details, and keep only a summary with the review: counts (of scans, their outcomes, repeated photos, restaurants, dishes, kinds of device and countries), the times of that day’s first and last scan and how the scans were spaced, the account’s plan and age, how many other accounts its free-trial card is on record for, and our automated read of whether the scanning looked automated, with its reasons (a person makes the decision). While an account stays paused, its scan attempts are kept like any other scan’s, for about 30 days, and are deleted when the review is next decided. Separately, to keep track of what scanning costs us, we record how much AI processing each scan used (never what the photo showed). That record is stored with your account ID for about 30 days; after that the ID is removed, and the rest (the day, which feature, how much processing) is kept for our cost totals until it is deleted after 13 months. To apply our daily limits we also keep, with your account, how many menu and recipe scans it made each day and how many of its photos could not be read that day; these daily counts are kept until the account is deleted.
• Server logs — our hosting provider keeps standard request logs (IP address, browser type, the page requested) to run and secure the Service.
• Cookies & local storage — used to keep you signed in and remember preferences (see Section 6).
• Search by meaning — this feature either runs locally in your browser (the text stays on your device) or, for ingredient search, sends your query to our search provider (Voyage AI) to rank results. We do not use your searches to identify you.
• Location — there are two ways “What’s in season” finds a place, and they are different. If you TYPE a place, that place name is sent to our geocoding provider (Photon, by komoot) to resolve it to a map location. If you choose to USE YOUR LOCATION, your device asks your permission and, if you grant it, the app reads your device’s coordinates and sends them to the same provider to turn them into a place name. Unless you choose Precise under Location in the app, the coordinates are rounded to about 11 km before they are sent. Your coordinates and the resolved place are then kept in your browser’s local storage on your device so the map opens where you left it; they are not sent to our servers, not stored in your account, and not used to identify or track you. You can decline the permission, and you can turn location sharing off again at any time in the app, which clears the stored value.

2. How we use information

• Provide, personalize, and maintain the Service (including tailoring pairings and nutrition to your preferences).
• Create and manage your account and process subscriptions and payments.
• Respond to support requests and communicate service updates.
• Monitor, secure, debug, and improve the Service and develop new features.
• Comply with legal obligations, enforce our Terms, and prevent abuse of the Service, including automated or abusive use of scanning.

3. Legal bases (EEA/UK users)

Where the GDPR or UK GDPR applies, we process personal data to perform our contractwith you (providing the Service), with your consent (e.g., sensitive dietary/allergy data and certain cookies), for our legitimate interests (securing and improving the Service), and to meet legal obligations. You may withdraw consent at any time.

4. How we share information

We do not sell your personal information. We share it only with:

• Service providers acting on our behalf under contract — hosting (Vercel), authentication & database (Supabase), payments (Stripe, RevenueCat, and Apple), AI processing (Anthropic for reading menu and recipe photos, Voyage AI for search), email delivery (Resend, for sign-up and password emails, forwarding feedback you send us to our inbox, our own account-review notices, and account notices we send you), and geocoding (Photon, by komoot).
• Anyone you send a share link to — a share link is public: anyone who has it can open the page, without an account, and see what it shows (see “Share links” in Section 1). We keep share pages out of search engines. You can stop sharing any link at any time under Account → Shared links, and the page stops working straight away.
• Legal and safety — to comply with law, enforce our Terms, or protect rights, safety, and security.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

5. Data retention

We keep personal data for as long as your account is active and as needed to provide the Service, then for the period required to meet legal, tax, accounting, and dispute-resolution obligations. You can ask us to delete your account at any time (see Section 8).

A share link is kept until you stop sharing it, delete the recipe it was made from, or delete your account; links to a restaurant’s pours end on their own after 90 days. We may switch off a link that breaks our Terms.

Android waitlist addresses are kept only until we send the one email saying the Android app is out, and then deleted.

Scan metadata is deleted about 30 days after the scan, or sooner when a review of the account is decided. The record of how much AI processing a scan used keeps your account ID for about 30 days after the scan, and is deleted after 13 months. Daily scan counts are kept with the account until it is deleted. A review’s summary (the counts, timings, plan, account age, trial-card count and automated read described in Section 1) is kept with the review until the account is deleted. To stop one card from starting more than one free trial, we keep our payment provider’s fingerprint of the card used for a trial (never the card number) and the subscription it started; when the account is deleted, this is kept without it. If we suspend an account for breaking our Terms, we keep a record that it was suspended, when and why, until the account is deleted, so the suspension holds. We keep our emails about a review or a suspension, which name the account and its email address, for as long as we need them to prevent fraud and abuse.

6. Cookies & local storage

We use cookies and browser local storage that are necessary to sign you in and remember your settings, and local storage for the random install ID used by the usage statistics in Section 1, which you can turn off in the app. We do not use advertising or third-party analytics cookies. You can control cookies through your browser; disabling essential cookies may break parts of the Service.

7. Security

We use reasonable technical and organizational measures (encryption in transit, hashed passwords, access controls) to protect your information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your rights & choices

Depending on where you live, you may have the right to access, correct, delete, export, or restrict processing of your personal data, to object to certain processing, and to withdraw consent. California residents may request to know, delete, and correct personal information and to opt out of “sale” or “sharing” — we do not sell or share personal information as those terms are defined. To exercise any right, contact us at contact@pair.support; we will verify and respond as required by law. You will not be discriminated against for exercising your rights.

9. International transfers

We may process and store information in countries other than yours, including the United States. Where required, we use appropriate safeguards (such as Standard Contractual Clauses) for cross-border transfers.

10. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

11. Changes to this Policy

We may update this Policy from time to time. We will post the new version with a revised “Last updated” date and, for material changes, provide additional notice.

12. Contact us

PAIR APP LLC, 15122 NW 87th Ct, Miami Lakes, FL 33018 — contact@pair.support. EEA/UK users may also reach us at that address for any data-protection request.

Terms of Service →